Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was testing something in my lab: I created an account, and then added a deny ACL to the domain, applying to that and all descendant objects, denying full control. However, I found that using adfind as the denied account, I was still able to list users (but some properties were hidden)!

I found that when applying a deny full control ACL only to the user caused the user to be hidden. However, the inherited permissions are shown and appear to deny everything.

Why is the inherited ACL not sufficient to prevent user listing?

The platform in this case is windows server 2008 R2.

share|improve this question
How and where exactly are you applying this ACL, what are you trying to accomplish, and is the account that you're doing this for a member of any privileged groups like Account Operator, Backup Operator, etc? – MDMarra Aug 22 '12 at 17:01
The ACL is applied on the entire domain, to this and all descendant objects, and applies to one user. The user is otherwise a normal account (not even a member of any groups). However, due to the use case for the account, we don't want it to be able to enumerate domain objects of any type. – Falcon Momot Aug 22 '12 at 20:16

Users can view all child objects of a container unless they have been denied the permission on the container to view child objects.

Controlling Object Visibility

"Active Directory Domain Services provide the ability to hide objects from users who have been denied certain rights. If an object is hidden, an application that is running with a user's credentials will not be able to enumerate or bind to the object.

"If a user is granted the ADS_RIGHT_ACTRL_DS_LIST access control right on a container, the user can view any of the child objects of the container. Likewise, if a user is denied the ADS_RIGHT_ACTRL_DS_LIST access control right on a container, the user cannot view any of the child objects of the container. This allows the contents of entire containers to be hidden."

share|improve this answer
The user has been denied it on all objects on the domain, but alas, AD automatically creates that permission on everything for authenticated users. – Falcon Momot Aug 22 '12 at 20:14
up vote 1 down vote accepted

It turns out that explicit allow ACLs take precedence over inherited deny ACLs, and there are explicit ACLs on every object for authenticated users. Alas; the only way to do this is to either strip the authenticated users permission on anything that needs hiding, or add an explicit ACL to every such object.

This makes it prohibitively difficult to deny a user access to enumerate anything in the domain, alas.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.